I was reading this article in the New York Times, and I was a bit torn. On one hand, the article was rife with swipes at Apple, things like:
Some bank executives acknowledged that they were were so scared of Apple that they didn’t speak up.
This makes it sound like Apple has a division of jackbooted thugs whose main job is to smash glass and rough up the bank executives who don’t toe the line.
That said, there were two points made that I think were right on the money.
The first point involves motivation. Banks were not so much interested in customer security as they were in being first into the Apple Pay wallet.
The banks, desperate to become their customers’ default card on Apple Pay — most add only one to their iPhones — did little to build their own defenses or to push Apple to provide more detailed information about its customers. Some bank executives acknowledged that they were were so scared of Apple that they didn’t speak up. The banks didn’t press the company for fear that they would not be included among the initial issuers on Apple Pay.
While that prose grinds my teeth (specifically, the maligning use of the words “desperate”, “scared” and “fear”, more appropriate for an op-ed piece like mine than for a post presented as news), it does speak to a bank’s motivation. The one fact here, “most add only one to their iPhones”, is tossed in without attribution, but I suspect there is a tendency to have one primary Apple Pay card and a race to be “that” card undermined the obligation to guard customer security, to ensure fraud prevention.
The second point involves a flaw in the process of dealing with red flags raised in the fraud prevention process.
It also appears that banks set up a flawed process to deal with the credit cards that it did flag. Affected users were directed to a customer care phone center, not a fraud prevention center. A customer care center’s mission is to help customers use their cards, leading more fraudulent cards to be approved for use on Apple Pay.
“Call centers are a poor approach for two reasons,” Mr. Abraham wrote. “One — fraudsters are better at social engineering than call center reps are at sniffing out fraud. In some cases, fraudsters are calling the call center themselves to ‘alert the bank about a trip out of town’ so that fraud rules looking for transaction anomalies (like a customer living in California and transacting in Miami) do not trip them up.”
The Mr. Abraham referred to in this post is Cherian Abraham, a controversial figure who the article says this about:
Some Apple supporters have sought to discredit Mr. Abraham based on his affiliation as an adviser to a company that is based on Apple’s main competitor, Android.
That aside, I see the two main culprits here as motivation and process. The banks did not put customers’ needs first and they made a strategic error in not putting their well trained fraud detection teams in the loop from the very beginning.
The good news is, though both the banks and Apple took a reputation hit here, it does sound like appropriate fixes are being wheeled into place and the long term prospects for Apple Pay look excellent.
I love how the article dismisses Mr Abraham’s very real conflict of interest as something only “Apple supporters” would see.
Also interesting that while his participation in Android payment companies is noted, the article fails to mention his larger role as head of mobile at Experian, a well known global identity provider/credit scoring company that would surely find lucrative business in “enhancing” the security of Apple Pay applications.
This is very much like the doomsday scenarios we keep hearing from antivirus companies salivating about bundling their security crapware into iOS.
So many conflicts and yet the only source on the extent of the fraud. Of course, most conveniently, everyone else is “scared of Apple”… well, sorry but that’s just BS.
Number one, the New York Times has dedicated itself, it would seem, to taking shots at Apple on a regular basis. Unverified, impeachable, unworthy (of the Times) potshots.
Second, I suspect that most people use one card mostly, because of rewards programs. The best rewards card I’ve even seen – and use for almost every purchase I do any more – is the Alaska Airlines Visa. Very generous program. And a $99 companion fare every year to anywhere they go. Why would I use any other rewards program? So I use two cards, actually. American Express for gas and sundries at Costco (which apparently is about to change, since Amex lost their deal with Costco) and my Alaska mileage card. In less than two years, I have 120,000 miles, and most of that was from spending. Only three flights a year to Alaska on average.
“This makes it sound like Apple has a division of jackbooted thugs whose main job is to smash glass and rough up the bank executives who don’t toe the line.”
I know, right? Doesn’t the Times Editorial Board know Katie Cotton retired almost a year ago?!
I’m shocked—shocked—at the suggestion that banks might not be doing the best job to prevent credit fraud!
There are so many things wrong with this article:
“Each time a transaction takes place, Apple generates the equivalent of a new credit card number so the merchant never actually sees a customer’s information.”
No, that’s not actually how Apple Pay works at all. It’s the same token for every transaction, but considering the fact that there’s no original reporting in this article, it doesn’t surprise me that the writer doesn’t even understand the basic functionality of the product he’s criticizing.
“No bank executive would speak with me on the record for fear of upsetting their company’s relationship with Apple.”
It doesn’t look like they spoke to him “off the record” either, because his only source is a paid shill for a direct Apple Pay competitor, Modo Payments. Even the dismissive disclosure of Abraham’s conflicts of interest only mentions the name “Android” and doesn’t make it clear that Modo is a direct competitor in mobile payments (using barcodes, naturally).
To call this bad journalism is an insult to real journalists.
Banks have economic incentive to not care about fraud until
that is removed this kind of identity fraud will continue.
I can give numerous example of fraud by Banks.
for example giving out loan using some one elses identity.
When the fraud was presented. They didn’t withdraw the loan
or prosecute.
Not only they get accounting benefit then they sell the loan
to bunch of thugs who hound you for years and years until
you tell them some information is wrong like social security.
Then everything goes quite.
This is not a great headline because there is no “Apple Pay fraud.” There is just “credit card fraud” and “bank fraud.” The fraud happens well before Apple Pay is used. It is the bank and credit card issuer who are responsible for securing the original credit card number.
Saying this is “Apple Pay fraud” is like saying that somebody shoplifting a CD and then ripping it into iTunes Match is “iTunes Match fraud.” No, it is just plain old shoplifting of a CD. The fact that the thief has a new way to utilize the stolen CD is just a function of the fact that legitimate CD buyers now have a new way to utilize their legitimately-purchased CD’s.
more appropriate for an op-ed piece like mine than for a post presented as news)
Such is the state of journalism. There was a time when the news was a very distinct animal from the opinions page. Now, there seem to be almost no writers left working for putative news agencies that can restrain themselves from making a story more about how the writer feels regarding a topic, rather than just reporting the facts.
I love how the article dismisses Mr Abraham’s very real conflict of interest as something only “Apple supporters” would see.
A tried a true tactic. You know you are setting up a straw man so you must explicitly state that the only people that disagree with you are slaves to the target of your bad argument.